CVE-2024-0193: Kernel: netfilter: use-after-free in nft_trans_gc_catchall_sync leads to privilege escalation

Q: What is the severity of CVE-2024-0193?

CVE-2024-0193 is classified as a high-severity use-after-free vulnerability in the Linux kernel's netfilter subsystem.

Q: How do I fix CVE-2024-0193?

To mitigate CVE-2024-0193, update your Linux kernel to the patched versions such as 5.10.223-1, 6.1.119-1, or higher as specified by your distribution.

Q: Which Linux versions are affected by CVE-2024-0193?

CVE-2024-0193 affects multiple versions of the Linux kernel including certain versions of Debian and Red Hat Enterprise Linux.

Q: What components are vulnerable in CVE-2024-0193?

The vulnerability in CVE-2024-0193 specifically impacts NFT_CHAIN and NFT_OBJECT objects within the netfilter subsystem.

Q: Is CVE-2024-0193 being actively exploited?

Currently, there is no public indication that CVE-2024-0193 is being actively exploited in the wild, but it is advised to address the vulnerability promptly.

Published Dec 22, 2023

Updated

A use-after-free flaw was found in the netfilter subsystem of the Linux kernel. If the catchall element is garbage-collected when the pipapo set is removed, the element can be deactivated twice. This can cause a use-after-free issue on an NFTCHAIN object or NFTOBJECT object, allowing a local unprivileged user with CAPNETADMIN capability to escalate their privileges on the system.

Other sources

A use-after-free vulnerability was discovered within the netfilter subsystem of the Linux kernel. If the catchall element is garbage-collected when the pipapo set is removed, the element can be deactivated twice. This causes a use-after-free on an NFTCHAIN object or NFTOBJECT object. A local unprivileged user could use this vulnerability to escalate their privileges on the system.

— Red Hat

Affected Software

184 affected componentsFixes available

Linux Linux kernel

redhat Enterprise Linux=9.0

debian/linux

6.1.176-16.1.190-16.12.107-16.12.115-27.2.12-17.2.15-1

redhat Codeready Linux Builder For Eus=9.2

redhat Codeready Linux Builder For Ibm Z Systems Eus=9.2_s390x

redhat Codeready Linux Builder For Power Little Endian Eus=9.2

redhat Enterprise Linux=9.2

redhat Enterprise Linux For Els=9.2

redhat Enterprise Linux For Eus=9.2

redhat Enterprise Linux For Ibm Z Systems=9.2_s390x

redhat Enterprise Linux For Ibm Z Systems Els=9.2

redhat Enterprise Linux For Ibm Z Systems Eus=9.2

redhat Enterprise Linux For Power Little Endian Els=9.2

redhat Enterprise Linux For Power Little Endian Eus=9.2

redhat Enterprise Linux For Update Services For Sap Solutions=9.2

redhat Enterprise Linux Server Aus=9.2

redhat Enterprise Linux Server For Power Little Endian Update Services For Sap Solutions=9.2

redhat Codeready Linux Builder=9.0

redhat Codeready Linux Builder For Eus=9.4

redhat Codeready Linux Builder For Eus=9.6

redhat Codeready Linux Builder For Ibm Z Systems=9.0_s390x

redhat Codeready Linux Builder For Ibm Z Systems Eus=9.4_s390x

redhat Codeready Linux Builder For Ibm Z Systems Eus=9.6_s390x

redhat Codeready Linux Builder For Power Little Endian=9.0_ppc64le

redhat Codeready Linux Builder For Power Little Endian Eus=9.4_ppc64le

redhat Codeready Linux Builder For Power Little Endian Eus=9.6_ppc64le

redhat Enterprise Linux=9.0

redhat Enterprise Linux For Arm 64=9.4_aarch64

redhat Enterprise Linux For Arm 64=9.6_aarch64

redhat Enterprise Linux For Arm 64 Els=9.4_aarch64

redhat Enterprise Linux For Arm 64 Els=9.6_aarch64

redhat Enterprise Linux For Arm 64 Eus=9.4_aarch64

redhat Enterprise Linux For Arm 64 Eus=9.6_aarch64

redhat Enterprise Linux For Els=9.4

redhat Enterprise Linux For Els=9.6

redhat Enterprise Linux For Eus=9.4

redhat Enterprise Linux For Eus=9.6

redhat Enterprise Linux For Ibm Z Systems=9.0_s390x

redhat Enterprise Linux For Ibm Z Systems=9.4_s390x

redhat Enterprise Linux For Ibm Z Systems=9.6_s390x

redhat Enterprise Linux For Ibm Z Systems Els=9.4_s390x

redhat Enterprise Linux For Ibm Z Systems Els=9.6_s390x

redhat Enterprise Linux For Ibm Z Systems Eus=9.4_s390x

redhat Enterprise Linux For Ibm Z Systems Eus=9.6_s390x

redhat Enterprise Linux For Power Little Endian Els=9.4_ppc64le

redhat Enterprise Linux For Power Little Endian Els=9.6_ppc64le

redhat Enterprise Linux For Power Little Endian Eus=9.0_ppc64le

redhat Enterprise Linux For Power Little Endian Eus=9.4_ppc64le

redhat Enterprise Linux For Power Little Endian Eus=9.6_ppc64le

redhat Enterprise Linux For Update Services For Sap Solutions=9.4

redhat Enterprise Linux For Update Services For Sap Solutions=9.6

redhat Enterprise Linux Server Aus=9.4

redhat Enterprise Linux Server Aus=9.6

redhat Enterprise Linux Server For Power Little Endian Update Services For Sap Solutions=9.4_ppc64le

redhat Enterprise Linux Server For Power Little Endian Update Services For Sap Solutions=9.6_ppc64le

redhat Enterprise Linux For Update Services For Sap Solutions=9.0

redhat Enterprise Linux For Arm 64=9.0_aarch64

redhat Enterprise Linux Server For Power Little Endian Update Services For Sap Solutions=9.0_ppc64le

Linux Linux kernel>=5.10.198<5.10.206

Linux Linux kernel>=5.15.118<5.15.146

Linux Linux kernel>=6.1.35<6.1.71

Linux Linux kernel>=6.3.9<6.6.10

All of the following

redhat Openshift Logging>=5.0<5.8.6

Any of the following

redhat Enterprise Linux=9.0

redhat Enterprise Linux For Ibm Z Systems=9.0

redhat Enterprise Linux For Power Little Endian=9.0

debian/linux<6.1.69-1

6.1.69-1

debian/linux<6.6.11-1

6.6.11-1

debian/linux<6.6.11-1

6.6.11-1

ubuntu/linux-hwe-edge*

ubuntu/linux-aws-5.0*

ubuntu/linux-aws-5.3*

ubuntu/linux-azure*

ubuntu/linux-azure-5.3*

ubuntu/linux-azure-edge*

ubuntu/linux-gcp*

ubuntu/linux-gcp-5.3*

ubuntu/linux-gke-4.15*

ubuntu/linux-gke-5.4*

ubuntu/linux-gkeop-5.4*

ubuntu/linux-hwe*

ubuntu/linux-oem*

ubuntu/linux-oracle-5.0*

ubuntu/linux-oracle-5.3*

ubuntu/linux-aws-5.15<5.15.0-1052.57~20.04.1

5.15.0-1052.57~20.04.1

ubuntu/linux-azure-5.15<5.15.0-1054.62~20.04.1

5.15.0-1054.62~20.04.1

ubuntu/linux-gcp-5.15<5.15.0-1049.57~20.04.1

5.15.0-1049.57~20.04.1

ubuntu/linux-gkeop-5.15<5.15.0-1035.41~20.04.1

5.15.0-1035.41~20.04.1

ubuntu/linux-hwe-5.15<5.15.0-92.102~20.04.1

5.15.0-92.102~20.04.1

ubuntu/linux-ibm-5.15<5.15.0-1045.48~20.04.1

5.15.0-1045.48~20.04.1

ubuntu/linux-intel-iotg-5.15<5.15.0-1048.54~20.04.1

5.15.0-1048.54~20.04.1

ubuntu/linux-lowlatency-hwe-5.15<5.15.0-92.102~20.04.1

5.15.0-92.102~20.04.1

ubuntu/linux-nvidia-tegra-5.15<5.15.0-1022.22~20.04.1

5.15.0-1022.22~20.04.1

ubuntu/linux-oracle-5.15<5.15.0-1050.56~20.04.1

5.15.0-1050.56~20.04.1

ubuntu/linux-riscv-5.15<5.15.0-1048.52~20.04.1

5.15.0-1048.52~20.04.1

ubuntu/linux-aws-5.11*

ubuntu/linux-aws-5.13*

ubuntu/linux-aws-5.8*

ubuntu/linux-azure-5.11*

ubuntu/linux-azure-5.13*

ubuntu/linux-azure-5.8*

ubuntu/linux-azure-fde*

ubuntu/linux-gcp-5.11*

ubuntu/linux-gcp-5.13*

ubuntu/linux-gcp-5.8*

ubuntu/linux-gke*

ubuntu/linux-gke-5.15*

ubuntu/linux-hwe-5.11*

ubuntu/linux-hwe-5.13*

ubuntu/linux-hwe-5.8*

ubuntu/linux-intel-5.13*

ubuntu/linux-oem-5.10*

ubuntu/linux-oem-5.13*

ubuntu/linux-oem-5.6*

ubuntu/linux-oracle-5.11*

ubuntu/linux-oracle-5.13*

ubuntu/linux-oracle-5.8*

ubuntu/linux-raspi2*

ubuntu/linux-riscv*

ubuntu/linux-riscv-5.11*

ubuntu/linux-riscv-5.8*

ubuntu/linux<5.15.0-92.102

5.15.0-92.102

ubuntu/linux-allwinner-5.19*

ubuntu/linux-aws<5.15.0-1052.57

5.15.0-1052.57

ubuntu/linux-aws-5.19*

ubuntu/linux-aws-6.2<6.2.0-1018.18~22.04.1

6.2.0-1018.18~22.04.1

ubuntu/linux-aws-6.5<6.5.0-1012.12~22.04.1

6.5.0-1012.12~22.04.1

ubuntu/linux-azure<5.15.0-1054.62

5.15.0-1054.62

ubuntu/linux-azure-5.19*

ubuntu/linux-azure-6.2<6.2.0-1019.19~22.04.1

6.2.0-1019.19~22.04.1

ubuntu/linux-azure-6.5<6.5.0-1011.11~22.04.1

6.5.0-1011.11~22.04.1

ubuntu/linux-azure-fde<5.15.0-1054.62.1

5.15.0-1054.62.1

ubuntu/linux-azure-fde-5.19*

ubuntu/linux-azure-fde-6.2<6.2.0-1019.19~22.04.1.1

6.2.0-1019.19~22.04.1.1

ubuntu/linux-gcp<5.15.0-1049.57

5.15.0-1049.57

ubuntu/linux-gcp-5.19*

ubuntu/linux-gcp-6.2<6.2.0-1021.23~22.04.1

6.2.0-1021.23~22.04.1

ubuntu/linux-gcp-6.5<6.5.0-1011.11~22.04.1

6.5.0-1011.11~22.04.1

ubuntu/linux-gke<5.15.0-1049.54

5.15.0-1049.54

ubuntu/linux-gkeop<5.15.0-1035.41

5.15.0-1035.41

ubuntu/linux-hwe-5.19*

ubuntu/linux-hwe-6.2*

ubuntu/linux-hwe-6.5<6.5.0-15.15~22.04.1

6.5.0-15.15~22.04.1

ubuntu/linux-ibm<5.15.0-1045.48

5.15.0-1045.48

ubuntu/linux-intel-iotg<5.15.0-1047.53

5.15.0-1047.53

ubuntu/linux-kvm<5.15.0-1049.54

5.15.0-1049.54

ubuntu/linux-lowlatency<5.15.0-92.102

5.15.0-92.102

ubuntu/linux-lowlatency-hwe-5.19*

ubuntu/linux-lowlatency-hwe-6.2*

ubuntu/linux-lowlatency-hwe-6.5<6.5.0-15.15.1.1~22.04.1

6.5.0-15.15.1.1~22.04.1

ubuntu/linux-nvidia<5.15.0-1043.43

5.15.0-1043.43

ubuntu/linux-nvidia-6.2<6.2.0-1015.15

6.2.0-1015.15

ubuntu/linux-nvidia-6.5<6.5.0-1014.14

6.5.0-1014.14

ubuntu/linux-nvidia-tegra<5.15.0-1021.21

5.15.0-1021.21

ubuntu/linux-nvidia-tegra-igx<5.15.0-1008.8

5.15.0-1008.8

ubuntu/linux-oem-5.17*

ubuntu/linux-oem-6.0*

ubuntu/linux-oem-6.1<6.1.0-1029.29

6.1.0-1029.29

ubuntu/linux-oem-6.5<6.5.0-1013.14

6.5.0-1013.14

ubuntu/linux-oracle<5.15.0-1050.56

5.15.0-1050.56

ubuntu/linux-oracle-6.5<6.5.0-1014.14~22.04.1

6.5.0-1014.14~22.04.1

ubuntu/linux-raspi<5.15.0-1045.48

5.15.0-1045.48

ubuntu/linux-realtime*

ubuntu/linux-riscv*

ubuntu/linux-riscv-5.19*

ubuntu/linux-starfive-5.19*

ubuntu/linux-starfive-6.2*

ubuntu/linux-xilinx-zynqmp<5.15.0-1027.31

5.15.0-1027.31

ubuntu/linux-bluefield<5.15.0-1033.35

5.15.0-1033.35

ubuntu/linux-intel-iot-realtime<5.15.0-1046.48

5.15.0-1046.48

ubuntu/linux-realtime<5.15.0-1053.59

5.15.0-1053.59

ubuntu/linux-aws-fips*

ubuntu/linux-azure-fips*

ubuntu/linux-gcp-fips*

ubuntu/linux-gcp-fips<5.15.0-1055.63+fips2

5.15.0-1055.63+fips2

ubuntu/linux-raspi<6.7.0-1001.1

6.7.0-1001.1

ubuntu/linux-raspi-realtime*

ubuntu/linux-vmware*

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade debian/linux to a version that resolves this vulnerability.
Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1
Upgrade
Upgrade debian/linux to a version that resolves this vulnerability.
Fixed in 6.1.69-1
Upgrade
Upgrade debian/linux to a version that resolves this vulnerability.
Fixed in 6.6.11-1
Upgrade
Upgrade ubuntu/linux-aws-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-1052.57~20.04.1
Upgrade
Upgrade ubuntu/linux-azure-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-1054.62~20.04.1
Upgrade
Upgrade ubuntu/linux-gcp-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-1049.57~20.04.1
Upgrade
Upgrade ubuntu/linux-gkeop-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-1035.41~20.04.1
Upgrade
Upgrade ubuntu/linux-hwe-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-92.102~20.04.1
Upgrade
Upgrade ubuntu/linux-ibm-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-1045.48~20.04.1
Upgrade
Upgrade ubuntu/linux-intel-iotg-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-1048.54~20.04.1
Upgrade
Upgrade ubuntu/linux-lowlatency-hwe-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-92.102~20.04.1
Upgrade
Upgrade ubuntu/linux-nvidia-tegra-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-1022.22~20.04.1
Upgrade
Upgrade ubuntu/linux-oracle-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-1050.56~20.04.1
Upgrade
Upgrade ubuntu/linux-riscv-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-1048.52~20.04.1
Upgrade
Upgrade ubuntu/linux to a version that resolves this vulnerability.
Fixed in 5.15.0-92.102
Upgrade
Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.
Fixed in 5.15.0-1052.57
Upgrade
Upgrade ubuntu/linux-aws-6.2 to a version that resolves this vulnerability.
Fixed in 6.2.0-1018.18~22.04.1
Upgrade
Upgrade ubuntu/linux-aws-6.5 to a version that resolves this vulnerability.
Fixed in 6.5.0-1012.12~22.04.1
Upgrade
Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.
Fixed in 5.15.0-1054.62
Upgrade
Upgrade ubuntu/linux-azure-6.2 to a version that resolves this vulnerability.
Fixed in 6.2.0-1019.19~22.04.1
Upgrade
Upgrade ubuntu/linux-azure-6.5 to a version that resolves this vulnerability.
Fixed in 6.5.0-1011.11~22.04.1
Upgrade
Upgrade ubuntu/linux-azure-fde to a version that resolves this vulnerability.
Fixed in 5.15.0-1054.62.1
Upgrade
Upgrade ubuntu/linux-azure-fde-6.2 to a version that resolves this vulnerability.
Fixed in 6.2.0-1019.19~22.04.1.1
Upgrade
Upgrade ubuntu/linux-gcp to a version that resolves this vulnerability.
Fixed in 5.15.0-1049.57
Upgrade
Upgrade ubuntu/linux-gcp-6.2 to a version that resolves this vulnerability.
Fixed in 6.2.0-1021.23~22.04.1
Upgrade
Upgrade ubuntu/linux-gcp-6.5 to a version that resolves this vulnerability.
Fixed in 6.5.0-1011.11~22.04.1
Upgrade
Upgrade ubuntu/linux-gke to a version that resolves this vulnerability.
Fixed in 5.15.0-1049.54
Upgrade
Upgrade ubuntu/linux-gkeop to a version that resolves this vulnerability.
Fixed in 5.15.0-1035.41
Upgrade
Upgrade ubuntu/linux-hwe-6.5 to a version that resolves this vulnerability.
Fixed in 6.5.0-15.15~22.04.1
Upgrade
Upgrade ubuntu/linux-ibm to a version that resolves this vulnerability.
Fixed in 5.15.0-1045.48
Upgrade
Upgrade ubuntu/linux-intel-iotg to a version that resolves this vulnerability.
Fixed in 5.15.0-1047.53
Upgrade
Upgrade ubuntu/linux-kvm to a version that resolves this vulnerability.
Fixed in 5.15.0-1049.54
Upgrade
Upgrade ubuntu/linux-lowlatency to a version that resolves this vulnerability.
Fixed in 5.15.0-92.102
Upgrade
Upgrade ubuntu/linux-lowlatency-hwe-6.5 to a version that resolves this vulnerability.
Fixed in 6.5.0-15.15.1.1~22.04.1
Upgrade
Upgrade ubuntu/linux-nvidia to a version that resolves this vulnerability.
Fixed in 5.15.0-1043.43
Upgrade
Upgrade ubuntu/linux-nvidia-6.2 to a version that resolves this vulnerability.
Fixed in 6.2.0-1015.15
Upgrade
Upgrade ubuntu/linux-nvidia-6.5 to a version that resolves this vulnerability.
Fixed in 6.5.0-1014.14
Upgrade
Upgrade ubuntu/linux-nvidia-tegra to a version that resolves this vulnerability.
Fixed in 5.15.0-1021.21
Upgrade
Upgrade ubuntu/linux-nvidia-tegra-igx to a version that resolves this vulnerability.
Fixed in 5.15.0-1008.8
Upgrade
Upgrade ubuntu/linux-oem-6.1 to a version that resolves this vulnerability.
Fixed in 6.1.0-1029.29
Upgrade
Upgrade ubuntu/linux-oem-6.5 to a version that resolves this vulnerability.
Fixed in 6.5.0-1013.14
Upgrade
Upgrade ubuntu/linux-oracle to a version that resolves this vulnerability.
Fixed in 5.15.0-1050.56
Upgrade
Upgrade ubuntu/linux-oracle-6.5 to a version that resolves this vulnerability.
Fixed in 6.5.0-1014.14~22.04.1
Upgrade
Upgrade ubuntu/linux-raspi to a version that resolves this vulnerability.
Fixed in 5.15.0-1045.48
Upgrade
Upgrade ubuntu/linux-xilinx-zynqmp to a version that resolves this vulnerability.
Fixed in 5.15.0-1027.31
Upgrade
Upgrade ubuntu/linux-bluefield to a version that resolves this vulnerability.
Fixed in 5.15.0-1033.35
Upgrade
Upgrade ubuntu/linux-intel-iot-realtime to a version that resolves this vulnerability.
Fixed in 5.15.0-1046.48
Upgrade
Upgrade ubuntu/linux-realtime to a version that resolves this vulnerability.
Fixed in 5.15.0-1053.59
Upgrade
Upgrade ubuntu/linux-gcp-fips to a version that resolves this vulnerability.
Fixed in 5.15.0-1055.63+fips2
Upgrade
Upgrade ubuntu/linux-raspi to a version that resolves this vulnerability.
Fixed in 6.7.0-1001.1

Event History

Dec 22, 2023

Data Sourced

via Red Hat·06:42 PM

DescriptionSeverityAffected Software

Jan 2, 2024

CVE Published

via MITRE·06:05 PM

Data Sourced

via MITRE·06:05 PM

DescriptionSeverityWeakness

Data Sourced

via OSV·06:15 PM

DescriptionSeverityAffected Software

Data Sourced

via NVD·06:15 PM

RemedyDescriptionSeverityWeaknessAffected Software

Jul 2, 2024

Exploit Published

via CISA·01:17 PM

Frequently Asked Questions

What is the severity of CVE-2024-0193?

CVE-2024-0193 is classified as a high-severity use-after-free vulnerability in the Linux kernel's netfilter subsystem.

How do I fix CVE-2024-0193?

To mitigate CVE-2024-0193, update your Linux kernel to the patched versions such as 5.10.223-1, 6.1.119-1, or higher as specified by your distribution.

Which Linux versions are affected by CVE-2024-0193?

CVE-2024-0193 affects multiple versions of the Linux kernel including certain versions of Debian and Red Hat Enterprise Linux.

What components are vulnerable in CVE-2024-0193?

The vulnerability in CVE-2024-0193 specifically impacts NFT_CHAIN and NFT_OBJECT objects within the netfilter subsystem.

Is CVE-2024-0193 being actively exploited?

Currently, there is no public indication that CVE-2024-0193 is being actively exploited in the wild, but it is advised to address the vulnerability promptly.

CVE-2024-0193: Kernel: netfilter: use-after-free in nft_trans_gc_catchall_sync leads to privilege escalation

Other sources

Affected Software

Remediation

Event History

Frequently Asked Questions

What is the severity of CVE-2024-0193?

How do I fix CVE-2024-0193?

Which Linux versions are affected by CVE-2024-0193?

What components are vulnerable in CVE-2024-0193?

Is CVE-2024-0193 being actively exploited?

Company

Resources

Contact